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(The following 3 slides are excerpts from the Institute of Internal Auditors (IIA) Practice Standards) 

INTERNATIONAL STANDARDS FOR THE PROFESSIONAL PRACTICE 
OF INTERNAL AUDITING (STANDARDS) 

Attribute Standards 


1000 - Purpose, Authority, and Responsibility 

The purpose, authority, and responsibility of the internal audit activity must be formally 
defined in an internal audit charter, consistent with the Definition of Internal Auditing, the 
Code of Ethics, and the Standards. The chief audit executive (CAE) must periodically 
review the internal audit charter and present it to senior management and the board for 
approval. 

Interpretation: 

The internal audit charter is a formal document that defines the internal audit activity's 
purpose, authority, and responsibility. The internal audit charter establishes the internal 
audit activity's position within the organization, including the nature of the chief audit 
executive's functional reporting relationship with the board; authorizes access to records, 
personnel, and physical properties relevant to the performance of engagements; and 
defines the scope of internal audit activities. Final approval of the internal audit charter 
resides with the board. 
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1110 - Organizational Independence 

The chief audit executive must report to a level within the organization that allows the internal audit activity 
to fulfill its responsibilities. The chief audit executive must confirm to the board, at least annually, the 
organizational independence of the internal audit activity. 

Interpretation: 

Organizational independence is effectively achieved when the chief audit executive reports functionally to 
the board. Examples of functional reporting to the board involve the board: 

Approving the internal audit charter; 

Approving the risk based internal audit plan; 

Approving the internal audit budget and resource plan; 

Receiving communications from the chief audit executive on the internal audit activity’s performance relative to its plan and 
other matters; 

Approving decisions regarding the appointment and removal of the chief audit executive; 

Approving the remuneration of the chief audit executive; and 

Making appropriate inquiries of management and the chief audit executive to determine whether there are inappropriate scope or 
resource limitations. 
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Considerations for Implementation 

Based on this foundational work, the CAE (or a delegate) drafts an internal audit charter. The IIA offers a model internal audit activity charter 
that may be used as a guide. Although they vary by organization, charters typically include the following sections: 

Introduction - to explain the overall role and professionalism of the internal audit activity, citing the relevant elements of the International 
Professional Practice Framework (IPPF). 

Authority - to specify the internal audit activity's full access to the records, physical property and personnel required to perform its 
engagements and to declare its accountability for safeguarding assets and confidentiality. 

Organization and Reporting Structure -to document the CAE's reporting structure. The CAE reports functionally to the board and 
administratively to a level within the organization that allows the internal audit activity to fulfill its responsibilities. This section may delve into 
specific functional responsibilities, such as approving the charter and audit plan, and hiring, compensating, and terminating the CAE; as well as 
administrative responsibilities, such as supporting information flow within the organization or approving human resource administration and 
budgets. 

Independence and Objectivity - to describe the importance of internal audit independence and objectivity and how these will be maintained, 
such as prohibiting internal audit from having operational responsibility or authority over areas audited. 

Responsibilities - to lay out major areas of ongoing responsibility, such as defining the scope of assessments, writing an audit plan and 
submitting it to the board for approval, performing assessments, communicating the results, providing a written audit report, and monitoring 
corrective actions taken by management. 

Quality Assurance and Improvement- to describe the expectations for maintaining, evaluating, and communicating the results of a quality 
program that covers all aspects of the internal audit activity. 

Signatures - to document the agreement between the CAE, a designated board representative, and the individual to whom the CAE reports, 
with the date, name, and title of signatories. 
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